CVE-2024-1072 is a High severity missing authorization flaw, scored 8.2, in the Website Builder by SeedProd plugin for WordPress. Versions up to 6.15.21 are affected. The record says 6.15.22 fixes it but adds an admin page bug, and recommends upgrading to 6.15.23.
What's affected
Versions up to and including 6.15.21 are affected, according to the record. The record states that 6.15.22 addresses the issue but introduces a bug affecting admin pages, and it suggests upgrading to 6.15.23. So the target is 6.15.23 or later.
The affected function is seedprod_lite_new_lpage, which lacked a capability check. That lets unauthenticated users change the content of coming soon pages, maintenance pages, login pages and 404 pages built with the plugin.
How to check if you're exposed
In the WordPress admin, open Plugins, Installed Plugins and read the version shown under Website Builder by SeedProd. From a shell with WP-CLI, list plugins and their versions.
wp plugin list --fields=name,status,version,update
Compare the version with the affected range above. If the plugin is not installed, you are not exposed through this CVE. The free in-browser dependency scan also covers dependencies in your own code, though WordPress plugins are tracked by the site, not a lockfile.
What to do now
- Check the installed SeedProd version on every site.
- Update to 6.15.23 or later, skipping over 6.15.22 given the admin page bug the record mentions.
- Review your coming soon, maintenance, login and 404 pages for content you did not write, including links and embedded scripts.
- If a page was altered, restore it and change administrator passwords as a precaution.
- Consider whether you need the plugin on production sites that are not in maintenance mode.
Why it matters
The class is missing authorization, CWE-862: the function does the work without checking whether the caller is allowed to. Here the changes are to page content, which is lower impact than code execution but still serious. A defaced login page or a 404 page with a fake form can be used to collect credentials from your visitors.
The record's score of 8.2 reflects the unauthenticated, network reachable nature. Its KEV flag is false.
Quick check
Is 6.15.22 good enough?
The record says it addresses the issue but introduces a bug affecting admin pages, and recommends 6.15.23.
What can an attacker change?
Per the record, the content of coming soon, maintenance, login and 404 pages created with the plugin.
Sources
- Wordfence advisory and plugin changeset, from the record references (Wordfence advisory, page body could not be read when fetched)
- NVD record and references for CVE-2024-1072
Last reviewed: 19 October 2026.
